I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 bytes is not acceptable and I must come up with a solution which adds smaller overhead.
The protocol messages do not repeat between re-keying, because they contain large enough sequence number (I can specify how often to re-key).
Question: Can I use the packet MAC as the nonce for the CTR mode encryption?
AFAIK the only requirement for the "counter" value is that it does not repeat for the same key, and that is guaranteed by message uniqueness (assuming MACs would not collide). Such "reuse" would save me 16 nonce bytes in each packet.